From: Remi Gacogne Date: Mon, 8 Mar 2021 16:13:30 +0000 (+0100) Subject: rec: Fix the EDNS padding documentation X-Git-Tag: rec-4.5.0-beta1~3^2~4 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8e299359ab07e63743ab7a7cf3516e88a247ba4b;p=thirdparty%2Fpdns.git rec: Fix the EDNS padding documentation We actually only pad response to queries coming from the whitelist, and then you can configure whether we add padding to queries with the EDNS padding option or not. --- diff --git a/pdns/pdns_recursor.cc b/pdns/pdns_recursor.cc index c2288b253a..b5feec9cf2 100644 --- a/pdns/pdns_recursor.cc +++ b/pdns/pdns_recursor.cc @@ -5602,8 +5602,8 @@ int main(int argc, char **argv) ::arg().setSwitch("aggressive-nsec-cache-size", "The number of records to cache in the aggressive cache. If set to a value greater than 0, and DNSSEC validation is enabled, the recursor will cache NSEC and NSEC3 records to generate negative answers, as defined in rfc8198")="100000"; - ::arg().set("edns-padding-from", "List of netmasks (proxy IP in case of XPF or proxy-protocol presence, client IP otherwise) for which EDNS padding will be enabled in responses to queries containing the EDNS padding option, provided that 'edns-padding-mode' is set")=""; - ::arg().set("edns-padding-mode", "Whether to add EDNS padding to all responses ('always') or only to responses for queries containing the EDNS padding option and coming from 'edns-padding-from' sources ('padded-queries-only', the default)")="padded-queries-only"; + ::arg().set("edns-padding-from", "List of netmasks (proxy IP in case of XPF or proxy-protocol presence, client IP otherwise) for which EDNS padding will be enabled in responses, provided that 'edns-padding-mode' is set")=""; + ::arg().set("edns-padding-mode", "Whether to add EDNS padding to all responses ('always') or only to responses for queries containing the EDNS padding option ('padded-queries-only', the default). In both modes, padding will only be added to responses for queries coming from `edns-padding-from`_ sources")="padded-queries-only"; ::arg().set("edns-padding-tag", "Packetcache tag associated to responses sent with EDNS padding, to prevent sending these to non-whitelisted clients.")="7830"; ::arg().setCmd("help","Provide a helpful message"); diff --git a/pdns/recursordist/docs/settings.rst b/pdns/recursordist/docs/settings.rst index f47ec3be69..65c4977a4e 100644 --- a/pdns/recursordist/docs/settings.rst +++ b/pdns/recursordist/docs/settings.rst @@ -619,7 +619,7 @@ Lower this if you experience timeouts. - Comma separated list of netmasks - Default: (none) -List of netmasks (proxy IP in case of XPF or proxy-protocol presence, client IP otherwise) for which EDNS padding will be enabled in responses to queries containing the EDNS padding option, provided that `edns-padding-mode`_ is set. +List of netmasks (proxy IP in case of XPF or proxy-protocol presence, client IP otherwise) for which EDNS padding will be enabled in responses, provided that `edns-padding-mode`_ is set. .. _setting-edns-padding-mode: @@ -630,7 +630,8 @@ List of netmasks (proxy IP in case of XPF or proxy-protocol presence, client IP - One of ``always``, ``padded-queries-only``, String - Default: ``padded-queries-only`` -Whether to add EDNS padding to all responses (``always``) or only to responses for queries containing the EDNS padding option and coming from `edns-padding-from`_ sources (``padded-queries-only``, the default). +Whether to add EDNS padding to all responses (``always``) or only to responses for queries containing the EDNS padding option (``padded-queries-only``, the default). +In both modes, padding will only be added to responses for queries coming from `edns-padding-from`_ sources. .. _setting-edns-padding-tag: